colorlink/advanced-mcp-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: sql_query accepts both sql and query params; describeTable handles wp_ prefix on sites with different prefix

Browse Source
This commit is contained in:
colorlink
2026-06-02 11:31:32 +00:00
parent d4989c958a
commit 9b757b3666
1 changed files with 28 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/Tools/RawSqlTools.php
+28 -17
View File
@@ -18,24 +18,22 @@ class RawSqlTools {
throw new \RuntimeException("Raw SQL is disabled. Enable it in AskTam MCP → Settings.");
}
$sql = trim($args['sql'] ?? '');
// Accept both 'sql' and 'query' as the parameter name
$sql = trim($args['sql'] ?? $args['query'] ?? '');
$limit = min((int)($args['limit'] ?? 100), 500);
if (empty($sql)) throw new \RuntimeException("SQL query is required.");
// Only SELECT allowed
if (!preg_match('/^\s*SELECT\b/i', $sql)) {
throw new \RuntimeException("Only SELECT queries are allowed.");
}
// Block dangerous patterns
foreach (self::$BLOCKED as $pattern) {
if (preg_match($pattern, $sql)) {
throw new \RuntimeException("Query contains blocked pattern.");
}
}
// Inject LIMIT if not present
if (!preg_match('/\bLIMIT\b/i', $sql)) {
$sql .= " LIMIT $limit";
}
@@ -47,11 +45,7 @@ class RawSqlTools {
throw new \RuntimeException("SQL error: " . $wpdb->last_error);
}
return [
'sql' => $sql,
'rows' => $results,
'count' => count($results ?? []),
];
return ['sql' => $sql, 'rows' => $results, 'count' => count($results ?? [])];
}
public static function listTables(array $args): array {
@@ -62,23 +56,40 @@ class RawSqlTools {
foreach ($tables as $t) {
$info = $wpdb->get_row("SELECT TABLE_ROWS, DATA_LENGTH+INDEX_LENGTH as SIZE FROM information_schema.TABLES WHERE TABLE_SCHEMA=DATABASE() AND TABLE_NAME='$t'", ARRAY_A);
$result[] = [
'table' => $t,
'rows' => (int)($info['TABLE_ROWS'] ?? 0),
'size' => size_format((int)($info['SIZE'] ?? 0)),
'table' => $t,
'rows' => (int)($info['TABLE_ROWS'] ?? 0),
'size' => size_format((int)($info['SIZE'] ?? 0)),
];
}
return ['tables'=>$result,'count'=>count($result),'prefix'=>$prefix];
return ['tables' => $result, 'count' => count($result), 'prefix' => $prefix];
}
public static function describeTable(array $args): array {
global $wpdb;
$table = sanitize_text_field($args['table']);
// Must use allowed prefix
$table = sanitize_text_field($args['table'] ?? '');
if (empty($table)) throw new \RuntimeException("table is required.");
// Accept the table name with or without the WP prefix.
// If the caller passes "wp_posts" and the actual prefix is "mwp_", try both.
if (strpos($table, $wpdb->prefix) !== 0) {
throw new \RuntimeException("Table must use the WP prefix: $wpdb->prefix");
// Maybe they passed "wp_posts" on a site with a different prefix — strip any leading wp_ and re-add correct prefix
$stripped = preg_replace('/^wp_/', '', $table);
$candidate = $wpdb->prefix . $stripped;
// Verify the candidate exists
$exists = $wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $candidate));
if ($exists) {
$table = $candidate;
} else {
// Last attempt: use exactly as given
$exists = $wpdb->get_var($wpdb->prepare("SHOW TABLES LIKE %s", $table));
if (!$exists) {
throw new \RuntimeException("Table not found: {$args['table']}. WP prefix is: {$wpdb->prefix}");
}
}
}
$columns = $wpdb->get_results("DESCRIBE `$table`", ARRAY_A);
if ($wpdb->last_error) throw new \RuntimeException($wpdb->last_error);
return ['table'=>$table,'columns'=>$columns,'count'=>count($columns)];
return ['table' => $table, 'columns' => $columns, 'count' => count($columns)];
}
}